From 0d9a790eb689b47b9aebc066a8e659626cc3e031 Mon Sep 17 00:00:00 2001 From: rshashank17 Date: Fri, 10 Jul 2026 12:20:48 +0530 Subject: [PATCH] test: Add 'needs review' label and harden csat.yml for Zizmor compliance --- .github/scripts/constant.js | 1 + .github/workflows/csat.yml | 15 ++++++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/scripts/constant.js b/.github/scripts/constant.js index 96e54f94d..9401065cc 100644 --- a/.github/scripts/constant.js +++ b/.github/scripts/constant.js @@ -28,6 +28,7 @@ let CONSTANT_VALUES = { DUPLICATE: 'duplicate', GITHUB: 'github', NEEDS_UPDATE: 'needs update', + NEEDS_REVIEW: 'needs review', READY_TO_PULL: 'ready to pull' }, STATE: { CLOSED: 'closed' }, diff --git a/.github/workflows/csat.yml b/.github/workflows/csat.yml index 92181a459..351d02b66 100644 --- a/.github/workflows/csat.yml +++ b/.github/workflows/csat.yml @@ -11,11 +11,20 @@ permissions: jobs: welcome: runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + issues: write steps: - - uses: actions/checkout@v3 - - uses: actions/github-script@v6 + - name: Checkout code + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - name: Run CSAT script + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: script: | const script = require('./.github/scripts/csat.js') - script({github, context}) + await script({github, context}) \ No newline at end of file